git: 590b45036ee1 - main - socket: Handle the possibility of a protocol with no ctloutput
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 31 Mar 2025 09:06:34 UTC
The branch main has been updated by markj:
URL: https://cgit.FreeBSD.org/src/commit/?id=590b45036ee16163f9eb8c34791d197e76de502d
commit 590b45036ee16163f9eb8c34791d197e76de502d
Author: Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2025-03-29 08:55:08 +0000
Commit: Mark Johnston <markj@FreeBSD.org>
CommitDate: 2025-03-31 09:01:09 +0000
socket: Handle the possibility of a protocol with no ctloutput
Add a default ctloutput handler and remove various NULL checks. This
fixes a problem wherein the generic SO_SETFIB handler did not check
whether the protocol has a ctloutput implementation before calling the
function pointer.
Reported by: syzkaller
Reviewed by: glebius
Fixes: caccbaef8e26 ("socket: Move SO_SETFIB handling to protocol layers")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D49436
---
sys/kern/uipc_domain.c | 7 +++++++
sys/kern/uipc_socket.c | 12 +++---------
2 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/sys/kern/uipc_domain.c b/sys/kern/uipc_domain.c
index 51e0f8cc7726..2d68e11b9f0a 100644
--- a/sys/kern/uipc_domain.c
+++ b/sys/kern/uipc_domain.c
@@ -97,6 +97,12 @@ pr_control_notsupp(struct socket *so, u_long cmd, void *data,
return (EOPNOTSUPP);
}
+static int
+pr_ctloutput_notsupp(struct socket *so, struct sockopt *sopt)
+{
+ return (ENOPROTOOPT);
+}
+
static int
pr_disconnect_notsupp(struct socket *so)
{
@@ -194,6 +200,7 @@ pr_init(struct domain *dom, struct protosw *pr)
NOTSUPP(pr_connect2);
NOTSUPP(pr_connectat);
NOTSUPP(pr_control);
+ NOTSUPP(pr_ctloutput);
NOTSUPP(pr_disconnect);
NOTSUPP(pr_listen);
NOTSUPP(pr_peeraddr);
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 63d30f04c8e0..ac00696236a5 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -3804,10 +3804,7 @@ sosetopt(struct socket *so, struct sockopt *sopt)
CURVNET_SET(so->so_vnet);
error = 0;
if (sopt->sopt_level != SOL_SOCKET) {
- if (so->so_proto->pr_ctloutput != NULL)
- error = (*so->so_proto->pr_ctloutput)(so, sopt);
- else
- error = ENOPROTOOPT;
+ error = (*so->so_proto->pr_ctloutput)(so, sopt);
} else {
switch (sopt->sopt_name) {
case SO_ACCEPTFILTER:
@@ -4017,7 +4014,7 @@ sosetopt(struct socket *so, struct sockopt *sopt)
error = ENOPROTOOPT;
break;
}
- if (error == 0 && so->so_proto->pr_ctloutput != NULL)
+ if (error == 0)
(void)(*so->so_proto->pr_ctloutput)(so, sopt);
}
bad:
@@ -4068,10 +4065,7 @@ sogetopt(struct socket *so, struct sockopt *sopt)
CURVNET_SET(so->so_vnet);
error = 0;
if (sopt->sopt_level != SOL_SOCKET) {
- if (so->so_proto->pr_ctloutput != NULL)
- error = (*so->so_proto->pr_ctloutput)(so, sopt);
- else
- error = ENOPROTOOPT;
+ error = (*so->so_proto->pr_ctloutput)(so, sopt);
CURVNET_RESTORE();
return (error);
} else {